CVE-2026-107709 in decompress-zip
Summary
by MITRE • 10/08/2026
A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause files to be written outside the intended extraction directory. Successful exploitation may allow arbitrary file overwrite, application compromise, or remote code execution depending on the target environment and writable sibling paths.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in decompress-zip prior to version 0.3.3 represents a critical path traversal flaw within the library's core extraction logic located in lib/decompress-zip.js. This component is widely used for handling ZIP archive operations, yet it fails to adequately sanitize or validate file paths extracted from untrusted archives. Specifically, the implementation does not strictly enforce that all entries remain confined within the designated target directory during the decompression process. When an attacker constructs a malicious ZIP archive containing entry names with relative path sequences such as dot-dot-slash patterns, the library incorrectly interprets these paths and proceeds to write files outside the intended extraction root. This failure in input validation allows for arbitrary file system writes by bypassing standard sandboxing mechanisms that rely on directory confinement.
From an operational perspective, this flaw poses a severe risk of remote code execution or application compromise depending on the context in which decompress-zip is utilized. If the vulnerable library processes archives uploaded by users within a web server environment, an attacker can overwrite critical configuration files, scripts, or executables located in sibling directories accessible to the running process. For instance, overwriting a file like .env or config.json could lead to credential theft or service disruption. In more severe scenarios where writable paths include executable locations such as /usr/bin or application-specific script folders, an attacker can inject malicious code that executes with the privileges of the target application. This effectively transforms a simple data processing utility into a vector for full system compromise, allowing lateral movement and persistence within the affected infrastructure.
This vulnerability aligns closely with Common Weakness Enumeration CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. The lack of canonicalization or strict boundary checking on file paths is a classic example of this weakness category. Furthermore, in terms of offensive security frameworks, this exploit technique maps directly to the MITRE ATT&CK tactic of Initial Access and Persistence via T1505 Server Software Component: Web Shell or similar mechanisms involving arbitrary file write capabilities. Attackers leverage these path traversal flaws to establish footholds that are difficult to detect because they mimic legitimate file operations until malicious payloads are triggered.
Mitigation strategies must prioritize immediate upgrading to version 0.3.3 or later, where the developers have implemented robust path validation checks. These updates typically involve canonicalizing all extracted paths and verifying that the resolved absolute path remains strictly within the intended extraction directory before any write operation is performed. Additionally, applications utilizing this library should implement defense-in-depth measures such as running with minimal file system permissions using principle of least privilege. Sandboxing techniques like chroot jails or containerization can further limit the blast radius if a traversal occurs. Regular auditing of third-party dependencies and static analysis tools configured to detect path manipulation weaknesses are also recommended to prevent similar issues in future development cycles.